forge/linux-uconsole
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions
linux-uconsole/drivers/char
History
Kefeng Wang 9845fb5a3f hpet: Fix division by zero in hpet_time_div() 
commit 0c7d37f4d9 upstream.

The base value in do_div() called by hpet_time_div() is truncated from
unsigned long to uint32_t, resulting in a divide-by-zero exception.

UBSAN: Undefined behaviour in ../drivers/char/hpet.c:572:2
division by zero
CPU: 1 PID: 23682 Comm: syz-executor.3 Not tainted 4.4.184.x86_64+ #4
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
 0000000000000000 b573382df1853d00 ffff8800a3287b98 ffffffff81ad7561
 ffff8800a3287c00 ffffffff838b35b0 ffffffff838b3860 ffff8800a3287c20
 0000000000000000 ffff8800a3287bb0 ffffffff81b8f25e ffffffff838b35a0
Call Trace:
 [<ffffffff81ad7561>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81ad7561>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
 [<ffffffff81b8f25e>] ubsan_epilogue+0x12/0x8d lib/ubsan.c:166
 [<ffffffff81b900cb>] __ubsan_handle_divrem_overflow+0x282/0x2c8 lib/ubsan.c:262
 [<ffffffff823560dd>] hpet_time_div drivers/char/hpet.c:572 [inline]
 [<ffffffff823560dd>] hpet_ioctl_common drivers/char/hpet.c:663 [inline]
 [<ffffffff823560dd>] hpet_ioctl_common.cold+0xa8/0xad drivers/char/hpet.c:577
 [<ffffffff81e63d56>] hpet_ioctl+0xc6/0x180 drivers/char/hpet.c:676
 [<ffffffff81711590>] vfs_ioctl fs/ioctl.c:43 [inline]
 [<ffffffff81711590>] file_ioctl fs/ioctl.c:470 [inline]
 [<ffffffff81711590>] do_vfs_ioctl+0x6e0/0xf70 fs/ioctl.c:605
 [<ffffffff81711eb4>] SYSC_ioctl fs/ioctl.c:622 [inline]
 [<ffffffff81711eb4>] SyS_ioctl+0x94/0xc0 fs/ioctl.c:613
 [<ffffffff82846003>] tracesys_phase2+0x90/0x95

The main C reproducer autogenerated by syzkaller,

  syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);
  memcpy((void*)0x20000100, "/dev/hpet\000", 10);
  syscall(__NR_openat, 0xffffffffffffff9c, 0x20000100, 0, 0);
  syscall(__NR_ioctl, r[0], 0x40086806, 0x40000000000000);

Fix it by using div64_ul().

Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Signed-off-by: Zhang HongJun <zhanghongjun2@huawei.com>
Cc: stable <stable@vger.kernel.org>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20190711132757.130092-1-wangkefeng.wang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-07-31 07:27:10 +02:00
..
agp char: amd64-agp: Use 64-bit arithmetic instead of 32-bit 2018-07-10 13:50:31 +10:00
hw_random hwrng: omap - Set default quality 2019-05-31 06:46:31 -07:00
ipmi ipmi:ssif: compare block number correctly for multi-part return messages 2019-05-22 07:37:43 +02:00
mwave char/mwave: fix potential Spectre v1 vulnerability 2019-01-31 08:14:36 +01:00
pcmcia char: pcmcia: remove redundant pointer dev 2018-07-03 13:01:57 +02:00
tpm tpm: Fix the type of the return value in calc_tpm2_event_size() 2019-04-27 09:36:40 +02:00
xilinx_hwicap
xillybus PCI: Add Altera vendor ID 2018-03-14 19:13:47 +01:00
adi.c char: sparc64: Add privileged ADI driver 2018-06-05 11:24:55 -07:00
apm-emulation.c proc: introduce proc_create_single{,_data} 2018-05-16 07:23:35 +02:00
applicom.c applicom: Fix potential Spectre v1 vulnerabilities 2019-03-10 07:17:20 +01:00
applicom.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
bsr.c
ds1620.c proc: introduce proc_create_single{,_data} 2018-05-16 07:23:35 +02:00
dsp56k.c vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
dtlk.c vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
efirtc.c proc: introduce proc_create_single{,_data} 2018-05-16 07:23:35 +02:00
generic_nvram.c
hangcheck-timer.c treewide: Switch DEFINE_TIMER callbacks to struct timer_list * 2017-11-21 15:57:05 -08:00
hpet.c hpet: Fix division by zero in hpet_time_div() 2019-07-31 07:27:10 +02:00
Kconfig tty: mark Siemens R3964 line discipline as BROKEN 2019-04-17 08:38:47 +02:00
lp.c char: lp: use true or false for boolean values 2018-01-25 10:56:02 +01:00
Makefile char: sparc64: Add privileged ADI driver 2018-06-05 11:24:55 -07:00
mbcs.c
mbcs.h
mem.c Char/Misc driver patches for 4.19-rc1 2018-08-18 11:04:51 -07:00
misc.c proc: introduce proc_create_seq{,_data} 2018-05-16 07:23:35 +02:00
mspec.c char: mspec: change return type to vm_fault_t 2018-04-23 13:51:53 +02:00
nsc_gpio.c
nvram.c proc: introduce proc_create_single{,_data} 2018-05-16 07:23:35 +02:00
nwbutton.c treewide: Switch DEFINE_TIMER callbacks to struct timer_list * 2017-11-21 15:57:05 -08:00
nwbutton.h treewide: Switch DEFINE_TIMER callbacks to struct timer_list * 2017-11-21 15:57:05 -08:00
nwflash.c
pc8736x_gpio.c
powernv-op-panel.c
ppdev.c vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
ps3flash.c
random.c random: add a spinlock_t to struct batched_entropy 2019-05-31 06:46:19 -07:00
raw.c treewide: Use array_size() in vzalloc() 2018-06-12 16:19:22 -07:00
rtc.c char: rtc: remove task handling 2018-08-02 17:16:03 +02:00
scx200_gpio.c
snsc.c vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
snsc.h
snsc_event.c
sonypi.c vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
tb0219.c
tlclk.c timer: Remove last user of TIMER_INITIALIZER 2017-10-05 15:01:18 +02:00
toshiba.c proc: introduce proc_create_single{,_data} 2018-05-16 07:23:35 +02:00
ttyprintk.c
uv_mmtimer.c
virtio_console.c virtio_console: initialize vtermno value for ports 2019-05-31 06:46:29 -07:00